GHSA-q6h7-xxp7-7429 CVE-2026-9798
Keycloak has an Authentication Bypass by Primary Weakness
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.38%
- Chance of exploitation in the next 30 days. Higher than 31.51% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-305 Authentication Bypass by Primary Weakness
- Fix
- None yet
- No fixed version published
Description
A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to repeated failed login attempts, an attacker with valid client credentials can exploit the Client-Initiated Backchannel Authentication (CIBA) flow to bypass this brute-force protection. This allows continued authentication attempts and token issuance even when the account should be locked, potentially enabling further unauthorized access attempts.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.keycloak:keycloak-services | <= 26.4.7 |
No fix yet |
| org.keycloak:keycloak-services | >= 26.5.0, <= 26.6.4 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-305: Authentication Bypass by Primary Weakness
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
References
Advisories
Packages
Other links
- github.com/keycloak/keycloak/issues/49432
- github.com/keycloak/keycloak/pull/49791
- github.com/keycloak/keycloak/pull/49903
- github.com/keycloak/keycloak/pull/49905
- github.com/keycloak/keycloak/commit/11c2695064cd93da1d333df3f69d4a4141e86c29
- github.com/keycloak/keycloak/commit/2edc6b112e2dedce63062b89ab3c7ae542e0d9ac
- github.com/keycloak/keycloak/commit/a11e3254efc16ae72ce5092b93b9f557a4ba43ae
- access.redhat.com/errata/RHSA-2026:50846
- access.redhat.com/errata/RHSA-2026:50847
- access.redhat.com/errata/RHSA-2026:50848
- access.redhat.com/errata/RHSA-2026:50849
- access.redhat.com/security/cve/CVE-2026-9798
- bugzilla.redhat.com/show_bug.cgi
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-v3f7-2p4r-mwfw Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass | High | Also affects org.keycloak:keycloak-services |
| GHSA-9jrw-8xf7-xqhq Keycloak vulnerable to information disclosure through arbitrary filesystem path probing | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-f5p5-6xmx-p252 Keycloak vulnerable to authorization bypass via incorrect uri comparison | High | Also affects org.keycloak:keycloak-services |
| GHSA-r7rc-c989-86g6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token | Medium | Also affects org.keycloak:keycloak-services |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass | Critical | Also affects org.keycloak:keycloak-services |
| GHSA-6g26-7cx5-mrrg Keycloak: Information disclosure due to user profile permission bypass | Low | Also affects org.keycloak:keycloak-services |
| GHSA-cpf7-j4cf-vqx4 Keycloak has an Out-of-bounds Read | Medium | Also affects org.keycloak:keycloak-services |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor